Generating the same SHA-256 code_challenge as Postman using Java

Question

When working on new HTTP request in Postman v11.2.14-canary01, and going to the Authorization tab and selecting SHA-256 for the Code Challenge Method and putting

6b890b254542c9de4603278153e1b127d21730d46ac2620e6e35514c

in the Code Verifier field, I can see that the https call says:

code_challenge=EKhdok_1ZKtBrevixgZqXxEHxn5pQjKkFA4bTVOmyH4

I'm trying to recreate this in Java.

        String text = "6b890b254542c9de4603278153e1b127d21730d46ac2620e6e35514c";
        MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
        byte[] hash = messageDigest.digest(text.getBytes(StandardCharsets.UTF_8));
        Base64.Encoder encoder = Base64.getEncoder();
        String value = encoder.encodeToString(hash);
        System.out.println("Result [" + value + "]");

Results in

Result [EKhdok/1ZKtBrevixgZqXxEHxn5pQjKkFA4bTVOmyH4=]

The results do not match. What are the specifics that should be used to "clean-up" the result?

Elliott Frisch · Accepted Answer · 2024-08-29 22:30:50Z

2

It's using a Base64 URL encoding. Change

Base64.Encoder encoder = Base64.getEncoder();

to

Base64.Encoder encoder = Base64.getUrlEncoder();

With that one change, I get (as expected)

Result [EKhdok_1ZKtBrevixgZqXxEHxn5pQjKkFA4bTVOmyH4=]

The trailing = is padding.

answered Aug 29, 2024 at 22:30

Elliott Frisch

202k20 gold badges166 silver badges265 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Generating the same SHA-256 code_challenge as Postman using Java

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related